NGWS SDK Documentation  

This is preliminary documentation and subject to change.
To comment on this topic, please send us email at ngwssdk@microsoft.com. Thanks!

/GS (Generate Security Check)

/GS

The /GS option is used inject security checks into the compiled code. Currently this works by detecting buffer overruns that have wiped out the return address: a common technique for hijacking code that does not enforce buffer size restrictions correctly. This is presently only done for the x86 platform, since the IA64 architecture does not suffer from the same problem. Accordingly, some of the following details are x86-specific.

On functions subject to buffer overrun problems, the compiler will allocate a variable before the return address. On function entry, that variable is loaded with a security cookie that is computed once at module load. Then, on function exit, a compiler helper is called to make sure the variable still has the same value as the security cookie.
If the value is not the same, an overwrite of the return address has potentially occurred, and so an error will be reported and the process (or at least the thread) terminated.
Unless an alternative handler has been supplied with __set_security_violation_handler, a MessageBox alerting the user to a potential security problem will be displayed and ExitProcess called.
When statically linking the CRT, each module will have its own handler. When dynamic linking is used, every component will share a common handler.

See Also

Compiler Options | Setting Compiler Options